Re: enable/disable features in running configuration
Alexandre Cassen <[email protected]>
| Newsgroups | gmane.linux.keepalived.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi Lennart, this is my goal, I already partly introduced low-level design into lib. At least can provide CLI and users can make their security choice. I completely agree, exposing telnet listener to a routable IP address is horrible, but you can bind it locally, or we can provide a AF_UNIX choice too. will investigate other design as Jan proposed. My other goal after VRRPv3 and CLI is to merge BFD code into keepalived to make VRRP link detection also based on BFD since most of modern routers are providing BFD, my goal here, is to code a strong BFD task just as VRRP stack. I already have a code, but this code need audit and lot of extension to make it production ready. regs, Alexandre > On 04 May 2015, at 16:27, Lennart Sorensen <[email protected]> wrote: > > On Mon, May 04, 2015 at 11:18:50AM +0200, jan wrote: >> Hi All, >> >> Some idés for a new parser >> >> To be secure and handle no ip address at all for routers in standby >> mode, it should be very handy to use LEVEL2 IN PROTOCOL LEVEL (on mac >> level), when talking to daemon, but tcp/ip needed for wan access. Some >> routers have mac-telnet, mac-ping, etc as standard, and discovery >> neighbors easy from management tool. >> >> When tcp is in use, only SSL or ssh style connections should be in use. >> Keepalived already use third party for SSL access reuse that. >> >> I think pure telnet is a bad idé from security point, use ssh. >> >> If telnet should be used restrict access at least by a ip access list. >> >> When redesign parser and extend its functionally some kind of socket >> communication and push >> technology should be implemented. > > quagga seems to manage fine with telnet access to each daemon, of course > only listening on the loopback interface IP, so you would need to ssh > to the machine, then telnet to the service to access the CLI (which is > quite cisco like). They ahve some kind of domain socket support too > although I don't think I have ever used it. > > No need to add a seperate ssh server to keepalived. > > -- > Len Sorensen ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Keepalived-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/keepalived-devel